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Director of Compliance, Ann Cavoukian 
and J recently attended the 11th Interna- 
tional Conference of Data Protection 
Commissioners in Berlin. Fellow Canadi- 
ans in attendance included federal Privacy 
Commissioner John Grace, Commis- 
sioner Jacques O’Bready and André 
Ouimet of Quebec’s Access to Informa- 
tion Commission, and other representa- 
tives from the federal and Quebec govern- 
ments. 


More than 100 participants from Europe, 
Scandinavia, Canada, Great Britain, and 
Australia met for the three day confer- 
ence, whose theme was “Data Flows 
Without Borders -- New Data Protection 
Concerns.” 


In attendance for the first time were dele- 
gates from Japan and Hungary. Protec- 
tion of privacy is an emerging issue in Ja- 
pan, and that government is planning to 
introduce legislation in the near future. 


In Hungary, as the Hungarian delegate 
indicated to the conference, freedom of 
information and protection of privacy is 
seen as an important development as the 
country builds towards democracy. 


The issue of transborder data protection 
is critical for privacy commissioners in 
European countries, whose responsibili- 
ties normally include jurisdiction over the 
private sector. 


A highlight of the conference was the 
formal adoption ofa resolution on Trans- 
border Data Protection Standards. 
Guidelines and recommendations on 
data protection have been adopted by the 


Council of Europe, the United Nations 
and other international organizations. 
The resolution recommended that data 
protection be given the same priority as 
the promotion of data processing and 
telecommunications in the development 
and use of international data services. 


The resolution also called for govern- 
ments to individually, and through inter- 
national bodies, move towards establish- 
ing equivalent legal safeguards as soon as 
possible; transborder data transmission 
should be checked and monitored to en- 
sure the protection of individual privacy. 


In today’s international environment, 
data networks are increasingly used for 
transfers of personal information -- for 
credit cards, travel bookings and within 
multinational enterprises. While the use 
of this new technology can bring signifi- 
cant benefit, at the same time it becomes 
increasingly difficult to safeguard the pri- 
vacy of individuals whose personal details 
are being transmitted around the world. 


Canadian Privacy Commissioner John 
Grace’s presentation to the conference 
discussed highlights of the Guidelines 
Concerning Computerized Personal 
Data Files, recently released by the 
United Nations. The General Assembly is 
expected to ratify these guidelines some- 
time this fall. 


The principles are essentially the same as 
those developed by the OECD and the 
Council of Europe, although Mr. Grace 
indicated that the new UN guidelines only 
offer the minimum protection. No at- 
tempt has been made to define privacy, 
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rather, general principles of privacy pro- 
tection are dealt with. 


Another feature of the new guidelines is 
that they apply to both manual and auto- 
mated data, and to both the private and 
public sectors. Penalties are referred to 
within the text, as is the recommendation 
that the guidelines be implemented by 
national or federal levels of government. 


During his excellent presentation, Mr. 
Grace made specific reference to two 
areas where he felt there was room for im- 
provement: He felt that the broad catego- 
ries under “Power to make exception” 
were too wide; and that the guidelines 
should make reference to the question of 
data destruction, which is currently ab- 
sent. 


However, he suggested that in spite of 
these shortcomings, the guidelines 
should be supported by those at the con- 
ference. 


Ann and I were both encouraged to find 
that the facsimile guidelines recently re- 
leased by our agency were very well re- 
ceived by the conference delegates. Sev- 
eral countries are in the process of ad- 
dressing similar questions relating to the 
security of facsimile transmissions, and 
they appeared to be pleased by our timely 
consideration of these issues. 


The Federal Agency which is located in 
Bonn and the Berlin Data Protection 
Commissioner’s offices were both re- 
sponsible for the organization of the con- 
ference, and they were very gracious hosts 
to us all. 


The ’80s have seen the emergence of nu- 
merous freedom of information and pri- 
vacy statutes around the world as a result 
of persistent lobbying by special interest 
groups in the’70s. Open government and 
the people’s right to know emerged as 
buzz words from the decade mostly due to 
the scandals surrounding Watergate in 
the United States. The resulting uproar 
created a climate for lobbyists in other 
countries to demand a law similar to the 
one the Americans had enacted in 1966. 


Freedom of Information came to be rec- 
ognized as a basic right, as fundamental to 
our democratic way of life as the other 
freedoms: speech, religion, the press and 
the right of assembly. Many Americans 
consider it to be an unwritten part of the 
Constitution. 


The access and privacy laws eventually 
passed were due to the fervour and con- 
centrated energy of a multitude of groups 
and individuals. Though there were no 
specific lobby groups at the time of the 
passage of the Ontario Freedom of Infor- 
mation and Protection of Privacy Act, it 
came about because of the earlier climate 
created by lobby groups, the long standing 
interest in the province and the resuit of 
exhauStive studies (especially the Wil- 
liams Commission Report in 1979, which 
came to be used as a source book on access 
to government information and privacy 
by government in other jurisdictions). 


However, a curious thing happened once 
the various pieces of legislation were 
passed. Those who were the prime mov- 
ers in demanding openness laws pro- 
ceeded to move onto other issues and 
failed to actually use the legislation. Once 
the laws were in place it appeared that 
many thought there were no further du- 
ties to be performed as the battle itselfhad 
been won. 


In fact, it had just started. What has come 
to be recognized by access advocates is the 
importance of using the statute. A rightis 
only as sacrosanct as it is exercised by the 
people who have that right. Freedom of 
speech and freedom of religion will con- 
tinue to be valued as long as they are exer- 


cised and governments allow individuals 
to exercise those rights. This point is ger- 
mane to any freedom of information stat- 
ute for the simple reason that such a law 
was designed to give people a basic right 
to know what their government is doing 
and why. 


It becomes important for people to know 
that such a law exists, so that they have the 
opportunity to dig into the dusty corners 
of government for information relevant 
to the conduct of their lives and to get a 
sense of what government is thinking on 
issues. This now gives the citizen an edge 
in his dealings with government and 
makes it clear that government is not om- 
nipotent. 


It becomes even more essential for indi- 
viduals to know they have access to their 
own personal file and a right to exercise 
some control over what is in that file and 
to make corrections if needed. This gives 
the individual some element of control 
over his relations with his government 
and serves to dispel the concept of “them 
and us.” 


This is why education about the existence 
of access statutes is so crucial to the whole 
freedom of information and privacy proc- 
ess. The United States failed to make any 
provisions for education of the public 
leaving the job up to public interest 
groups. Legislators in other countries 
neglected to make any such provisions, 
including the drafters of Canada’s Access 
to Information and Privacy Acts. A Fed- 
eral Parliamentary All Party Committee 
recommended that special measures be 
taken to educate people about their rights 
under these laws. Both federal Informa- 
tion Commissioner Inger Hansen and 
Privacy Commissioner John Grace have 
taken steps to educate people about their 
new rights but on the whole the federal 
government has been criticized for not 
conducting any sort of coordinated cam- 
paign leaving it up to the Commissioners. 
Quebec’s Access to Information Com- 
mission has taken similar limited meas- 
ures, and plans to expand their communi- 
cations program to let Quebecers know 
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about the legislation and encourage them 
to exercise their rights. 


In this sense, Canada has been much more 
progressive than other jurisdictions. In 
countries where measures have not been 
introduced to inform people of these 
rights and no one is undertaking the func- 
tion, the legislation has come under at- 
tack and, in some instances, has weak- 
ened. 


In the final stages of passage of the On- 
tario Act, an amendment was added re- 
quiring the Information and Privacy 
Commissioner to educate the people of 
the province about the law. This was a 
pivotal addition as it recognized that 
without the knowledge that the citizen 
had a new right it could not be exercised. 
As access laws were intended for use by all 
the people and not just a select few, the 
educational role becomes an important 
function. 


The federal government is now making 
plans to run a national awareness pro- 
gram about Canadians’ rights under their 
Access and Privacy Acts. These plans 
have been in the developmental stage for 
a long time and have yet to be imple- 
mented. Plans are afoot in Ontario to 
inform the people in the province about 
the new law and what it means to them. 


It is imperative that these steps be taken in 
all jurisdictions. We are now awash in 
information technology which is coming 
to dominate our lives. Never has the issue 
of privacy been more important. 


Beyond this, and on a more fundamental 
level vital for the health of democracy, for 
the concept of open government to con- 
tinue to be viable it is important that the 
people know that they have a right to 
know. 

by Tom Riley 


Tom Riley, President of Riley Information Serv- 
ices, has specialized in freedom of information 
and privacy issues for 15 years. His address: 
P.O. Box 261, Station F., Toronto, Ontario M4Y 
2L5. Phone: (416) 593-7352. 


IMPLICATIONS OF ORDER NO 


The Commissioner’s recent decision, 
Order 81, should be read with interest by 
anyone involved with Ontario’s access 
scheme. This decision identifies some key 
responsibilities of the head of an institu- 
tion in responding to a request under the 
Act, and introduces a solution to a prob- 
lem that occurs in cases where it is unduly 
expensive for the institution to produce 
the record in order for the head to makea 
decision regarding disclosure. 


Most people who have been involved with 
the Ontario Act are now familiar with the 
routine followed by institutions in decid- 
ing whether a record should be released. 
The steps go roughly as follows: 


1. The Freedom of Information and 
Privacy Co-ordinator reviews the request 
and clarifies it with the requester if neces- 


sary. 


2. The Co-ordinator contacts those 
employees within the institution who 
might be able to locate the relevant rec- 
ord, letting them know what the requester 
is looking for. 


3. The Co-ordinator obtains the record 
and presents it to the appropriate deci- 
sion-maker within the institution for con- 
sideration. 


*NB _As soon as the Co-ordinator be- 
comes aware of the volume and/or location 
of the relevant records, he or she is in a 
position to decide whether the conditions 
for a time extension under subsection 27(1) 
of the Act are present; ie. the request is for 
a large number of records or necessitates a 
search through a large number of records 
and meeting the 30-day time limit would un- 
reasonably interfere with the operations of 
the institution [subsection 27(1)(a)], or 
consultations that cannot reasonably be 
completed within the 30-day time limit are 
necessary to comply with the request [sub- 
section 27(1)(b)]. 


4. The decision-maker (i.e. the head, or 
the person delegated by the head) reviews 
the record and undertakes whatever con- 
sultations are necessary to determine if 


any exemptions in the Act apply. If any 
applicable exemptions are discretionary, 
the decision-maker decides whether dis- 
cretion should be exercised in favour of 
releasing the record, or any part of the 
record, in the circumstances of the par- 
ticular case. 


*NB _AsS soon as the contents of the rec- 
ord are known, the institution can decide 
whether it might contain third party infor- 
mation [subsection 17(1)] or certain per- 
sonal information [subsection 21(1)(f)], 
and whether the provisions relating to af- 
fected persons under section 28 of the Act 


apply. 


5. The decision-maker decides whether 
or not to release the record, and issues a 
notice to the requester under section 26 of 
the Act. A fees estimate, if fees are to be 
charged, usually accompanies the section 
26 notice. 


Order No. 81 is the first time the Commis- 
sioner has addressed the contents of a 
section 26 notice that denies access. In his 
Order the Commissioner indicated that 
the notice must be detailed if the institu- 
tion intends to deny access to a record, 
either in whole or in part. In interpreting 
the requirements for notice as outlined 
under subsection 29(1)(b) of the Act, the 
Commissioner found that the decision- 
maker should provide the requester with 
a general description of the records re- 
sponding to the request (ie: words that 
generally describe the record without 
revealing the contents, such as “three 
memos” or “a 500-page report”). For 
each record withheld by the institution, 
the decision-maker should clearly iden- 
tify the specific subsections of the Act 
being relied on, and indicate to which part 
of an individual record each exemption 
applies. These requirements apply to 
every decision in which a record is being 
denied, in whole or in part, except when 
the decision-maker is refusing to confirm 
or deny the existence of a requested rec- 
ord. 


Order No. 81 also states that, if the insti- 
tution has decided to charge fees, the 
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requester should be made aware of the 
possibility of a fee waiver pursuant to 
section 57(3) at the time the section 26 
notice is issued, and the requester should 
be asked for representations regarding 
the head’s discretion to waive fees. By 
following this procedure, the decision- 
maker can exercise discretion on the 
question of fee waiver in the first instance, 
thereby avoiding an appeal on the fees 
issue right away. 


Finally, Order No. 81 states that the issu- 
ance of a fees estimate has the effect of 
suspending the 30-day time limit imposed 
by section 26. It is reinstated on the day 
after the fees issue has been resolved, 
either by the requester paying a deposit, 
the head granting a waiver, or the ques- 
tion of fees being resolved on appeal by 
order of the Commissioner. Once rein- 
Stated, the institution must then give ef- 
fect to its decision by producing the rec- 
ords it is willing to disclose within the 
balance of the 30-day period. 


In addition to the general direction pro- 
vided by the Commissioner in dealing 
with normal request Situations, Order 
No. 81 also dealt with the particular situ- 
ation where records that would respond 
to the request were large in volume and 
widely dispersed around the institution. 
In this appeal the institution estimated 
that to simply retrieve the records (step 2, 
described above), in order for the head to 
make a decision on disclosure would cost 
several thousand dollars. The Commis- 
sioner stated that in situations of this type, 
the Act allows the institution to provide 
the requester with a fees estimate, accom- 
panied by an “interim” notice under sec- 
tion 26. 


To arrive at the appropriate fees estimate, 
the decision-maker has two options: ei- 
ther to consult with employees of the in- 
stitution who are familiar with the type 
and contents of the requested record; or 
to obtain and review a representative 
sample of the records and base the fees 
estimate on it. If, during the process of 
determining the fees estimate, the head 
decides that one or more exemptions in 


the Act might apply, this information 
should be included as part of the “in- 
terim” section 26 notice. If no indication 
is made at the time a fees estimate is 
presented that an exemption may be 
claimed, the Commissioner found that it 
was reasonable for a requester to infer 
that the records would be released in their 
entirety upon payment of the required 
fees. 


Order No. 81 clearly sets out the informa- 
tion that an “interim” section 26 notice 
should include a statement that a final 
decision respecting access has not yet 
been made, and the identification of pos- 
sible exemptions, if applicable. 


As with the usual section 26 notices, an 
“interim” notice should set out a refer- 
ence to the fee waiver provision of subsec- 
tion 57(3) of the Act, and solicit represen- 
tations from the requester regarding the 
head’s discretion to waive fees. 


Because the “interim” section 26 notice 
does not reflect the institution’s final 
position regarding the release of records, 
it is not appealable to the Commissioner. 
The fees estimate, on the other hand, can 
be appealed. 


The issuance of a fees estimate in con- 
junction with an “interim” notice sus- 
pends the 30-day time limit under section 
26, in the same way as a regular section 26 
notice, as discussed earlier. 


In the remaining time left after the fees 
issue has been resolved, the institution 
must retrieve and review all of the re- 
quested records for the purpose of deter- 
mining whether access can be given. If the 
grounds for a time extension under sec- 
tion 27 exist, the appropriate notice can 
be issued, and, depending on the content 
of the record, the consultation procedure 
involving affected persons under section 
28 might also be required. If the institu- 
tion’s final decision gives less than total 
disclosure, section 29 of the Act identifies 
the type of information which must be in- 
Cluded in the notice. 


To summarize, the steps that an institu- 
tion would take in responding toa request 
where the relevant records are unduly 


expensive to produce in order to decide 
the question of disclosure are as follows: 


1. Ifthe Co-ordinator discovers that the 
records would be unduly expensive to re- 
trieve, he or she either: 

a) arranges for a representative 
sample of the record to be produced for 
consideration by the appropriate deci- 
sion-maker; or 

b) identifies an employee of the in- 
stitution who can brief the decision- 
maker as to the nature, approximate vol- 
ume and contents of the requested rec- 
ords. 


2. The decision-maker issues an “in- 
terim” section 26 notice, indicating 
whether the decision outlined in the no- 
tice is based on consultation or a repre- 
sentative sample of the record. If fees are 
to be charged, a fees estimate accompa- 
nies the “interim” section 26 notice, to- 
gether with an explanation of the waiver 
provision of the Act. If the institution 
contemplates the application of any ex- 
emptions, the decision-maker also ad- 
vises the requester of this possibility. 
Once this fees estimate is sent, the 30-day 
time period for a response is suspended. 


3. Ifa fees estimate is issued and the 
requester responds with an application 
for waiver, the decision-maker considers 
and decides whether waiver will be given. 


4. The30-day time period is reactivated 
upon receipt of a deposit, a decision to 


waive fees, or the issuance of an Order by 
the Commissioner. Subject to any time 
extensions under section 27 and/or spe- 
cial procedures relating to affected per- 
sons under section 28, the decision-maker 
then retrieves and reviews all records cov- 
ered by the request and issues the final 
notice under section 26 within the balance 
of the thirty day period. 


It is expected that the use of the special 
procedures relating to the issuance of “in- 
terim” section 26 notices will be limited, 
since most records are not unduly expen- 
sive to produce for consideration as to dis- 
closure. However, when such situations 
do arise, following the procedures out- 
lined above will be fair and reasonable to 
both requesters and institutions, and the 
procedures are consistent with the overall 
principles of the Freedom of Information 
and Protection of Privacy Act. As the 
Commissioner stated in his Order: 


“... they strike an appropriate balance 
between the “user pay” concept established 
by section 57, and the requester’s right to 
have sufficient information on which to 
make an informed decision respecting pay- 
ment of fees.” 


The procedures also help to eliminate 
problems that arise in situations where 
institutions are insufficiently familiar 
with the scope and content of the re- 
quested record before providing request- 
ers with fees estimates and section 26 
notices. 
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